Crypto Due Diligence Checklist: Security Before You Invest

Video transcript

Docs describe a protocol's code. The chain shows what is deployed, and who can change it. Before you invest, ask for evidence, not assurances.

In Guardian's admin key census of 25 large DeFi protocols on Ethereum, docs and chain disagreed at six protocols.

An audit covers one commit. Collect every report with its commit hash, list the deployed addresses, and review the upgrade log. Then match deployed code to the final commit.

Next, map who can upgrade, pause or mint, and with what delay. In the same sample, 21.7 percent of TVL sits where a multisig can change core code at once.

Turn each finding into a question for the founders. No upgrade delay? Ask when a timelock is coming. A single key that can mint? Ask why it is not behind a delay.

A protocol inherits the risk of everything it trusts: oracles, bridges, sequencers and keepers. Offchain managers matter too. In November 2025, Stream Finance said an external fund manager disclosed a 93 million dollar loss.

Check team OpSec and every incident post-mortem too. Then remember, your diligence expires at the next upgrade. Agree what the team will report, and watch the chain for the rest.

Guardian's capital allocator service reads deployed code, not the repository, and scores each position from 0 to 100 with visible weights. Monitoring moves the score when the protocol changes.

Read the full checklist and its red flags, or talk to Guardian before you wire.

A protocol’s docs describe its code. The chain shows what is deployed, and who can change it.

The two often differ. In our admin key census of 25 of the largest DeFi protocols on Ethereum, “Docs and chain disagreed at six protocols.”

This checklist is for VCs, funds and corporate development teams. It covers security; legal, token and market diligence run alongside it.

An investor has one thing a protocol’s users lack: access to the team. Use it to ask for evidence, then check that evidence yourself.

Code and Audits

An audit covers one commit. You are investing in what is deployed, and in code not yet written.

Ask the team for:

• Every audit report, with the commit hash each one reviewed.
• The deployed address list, on every chain.
• An upgrade log since the last audit, and who reviewed each change.
• Findings acknowledged rather than fixed, and why.
• How the next release will be reviewed before it ships.

Then match deployed code to the reports. As our bytecode verification study puts it: “Compare against the final commit, or a correct deployment looks wrong.”

Our DeFi protocol due diligence checklist, written for regulated firms, walks through the chain-side steps.

Admin Keys and Timelocks

Next, the keys. Ask for every privileged power: upgrade, pause, mint, freeze, set an oracle and grant roles. For each, get the holder, its threshold and its delay.

Then check the list against the chain. Across the census’s 25 protocols: “At 5, a multisig can upgrade with no delay; at 8, one key can pause, freeze or blacklist without a timelock.”

The money behind those paths is large. Across the same sample, our TVL report found “$20.59 billion of $95.04 billion (21.7%) sits where a multisig can change core code at once.”

Turn each finding into a question for the founders:

Oracles, Bridges and Offchain Parties

A protocol inherits the risk of everything it trusts. Ask what happens when each one fails:

• Oracles: what the protocol does with a wrong or stale price.
• Bridges: how many signers stand between an attacker and bridged funds.
• Chains and sequencers: what a halt does to liquidations and withdrawals.
• Keepers and bots: who runs them, and with which keys.
• Offchain managers: who holds assets outside the contracts, and how they report.

The last one is easy to miss. In November 2025, Stream Finance said an external fund manager had disclosed a “$93 million loss in Stream fund assets.”

Stream suspended withdrawals and deposits, The Block reported. No contract review covers assets held by an outside manager.

Team OpSec

Keys sit on people’s devices. Ask how the team protects both:

• Who holds signing keys, and on which devices?
• How do signers check what a transaction does before signing?
• Are hardware security keys required on critical accounts, with no SMS recovery?
• How are new hires, contractors and meeting invites verified?
• When were cloud, CI/CD, web apps and the front end last pentested?
• Who controls the domain, DNS and registrar account?

Our OpSec baseline for founders and teams sets out what good looks like.

Incidents and Monitoring

Ask for every past incident, with its post-mortem. Then check three things:

• Users were made whole, and how.
• The root cause was fixed and retested.
• The team disclosed promptly, in public.

Then ask who watches the protocol today:

• Who is alerted to upgrades, role changes and large outflows?
• Who can pause, and how fast can they reach a signer?
• Is there a bug bounty, and a rehearsed incident response plan?

Your diligence expires at the next upgrade. Agree which changes the team will tell you about, and watch the chain for the rest.

Red Flags

• Audit reports with no commit hash, or audited code that was never deployed.
• An upgrade path with no delay, or a delay shorter than withdrawals.
• One key that can mint, burn from users or move balances.
• Docs that disagree with chain state.
• Assets with an offchain manager and no independent reporting.
• A past incident with no post-mortem.
• No one to reach on a Sunday.

How Guardian Helps

Guardian’s capital allocator service underwrites positions on evidence. It reads the deployed code, not the repository, and maps who can upgrade, pause or drain.

Each position gets a 0 to 100 score, with the weights visible:

Bands run from unacceptable to strong and are mapped to your mandate. Monitoring then moves the score when the protocol upgrades, adds signers or swaps an oracle.

Portfolio teams can track the same rights on their own contracts with Risk Monitoring.

Frequently Asked Questions

What should a crypto due diligence checklist cover?

For security: deployed code against audits, admin keys and timelocks, oracle and bridge dependencies, offchain managers, team OpSec, incident history and monitoring. Legal, token and market diligence run alongside it.

Is a smart contract audit enough for investment due diligence?

No. An audit covers one commit and a defined scope. Check that deployed code matches the final reviewed commit, what changed since, what was out of scope, and the keys and offchain systems no contract audit reviews.

When should a fund run security due diligence?

Before terms are final, so findings can still shape the deal. Then again after major upgrades, because diligence only covers the code and signers that existed when you checked.

What are red flags in crypto due diligence?

Audits without commit hashes, upgrades with no delay, single keys that can mint or move balances, and docs that disagree with the chain. Also assets held by offchain managers without reporting, and past incidents with no post-mortem.

Sources

• Guardian: Who Controls DeFi? Admin Keys Behind 25 Top Protocols (November 2026)
• Guardian: TVL Behind Upgradeable Contracts Without a Timelock (November 2026)
• Guardian: Deployed vs Audited Code: What Bytecode Verification Found (November 2026)
• The Block: Stream Finance halts withdrawals and deposits after $93 million loss disclosed (November 4, 2025)
• Guardian: Capital Allocators
• Guardian: Risk Monitoring